[asterisk-dev] Asterisk 13.19.2, 14.7.6, 15.2.2 and 13.18-cert3 Now Available (Security)

Thu Feb 22 05:32:28 CST 2018

Pjproject was rather quick this time around.
Your patches 0070 & 0071 (in third-party/pjproject/patches) have already been incorporated and released in 2.7.2.
So I guess you can update the reference to 2.7.2 and remove the patches in the branches.

With best regards

Florian Floimair
Innovation - Software-Development

COMMEND INTERNATIONAL GMBH
A-5020 Salzburg, Saalachstraße 51
Tel: +43-662-85 62 25
Fax: +43-662-85 62 26
http://www.commend.com

Security and Communication by Commend

FN 178618z | LG Salzburg

Von: asterisk-dev-bounces at lists.digium.com [mailto:asterisk-dev-bounces at lists.digium.com] Im Auftrag von Asterisk Development Team
Gesendet: Mittwoch, 21. Februar 2018 22:57
An: Asterisk Developers Mailing List <asterisk-dev at lists.digium.com>
Betreff: [asterisk-dev] Asterisk 13.19.2, 14.7.6, 15.2.2 and 13.18-cert3 Now Available (Security)

The Asterisk Development Team would like to announce security releases for
Asterisk 13, 14 and 15, and Certified Asterisk 13.18. The available releases are
released as versions 13.19.2, 14.7.6, 15.2.2 and 13.18-cert3.

These releases are available for immediate download at

https://downloads.asterisk.org/pub/telephony/asterisk/releases
https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases

The following security vulnerabilities were resolved in these versions:

  *   AST-2018-001: Crash when receiving unnegotiated dynamic payload
The RTP support in Asterisk maintains its own registry of dynamic codecs and
desired payload numbers. While an SDP negotiation may result in a codec using
a different payload number these desired ones are still stored internally.
When an RTP packet was received this registry would be consulted if the
payload number was not found in the negotiated SDP. This registry was
incorrectly consulted for all packets, even those which are dynamic. If the
payload number resulted in a codec of a different type than the RTP stream
(for example the payload number resulted in a video codec but the stream
carried audio) a crash could occur if no stream of that type had been
negotiated. This was due to the code incorrectly assuming that a stream of the
type would always exist.

  *   AST-2018-002: Crash when given an invalid SDP media format description
By crafting an SDP message with an invalid media format description Asterisk
crashes when using the pjsip channel driver because pjproject's sdp parsing
algorithm fails to catch the invalid media format description.

  *   AST-2018-003: Crash with an invalid SDP fmtp attribute
By craft i ng an SDP message body with an invalid fmtp attribute Asterisk
crashes when using the pjsip channel driver because pjproject's fmtp retrieval
function fails to check if fmtp value is empty (set empty if previously parsed
as invalid).

  *   AST-2018-004: Crash when receiving SUBSCRIBE request
When processing a SUBSCRIBE request the res_pjsip_pubsub module stores the
accepted formats present in the Accept headers of the request. This code did
not limit the number of headers it processed despite having a fixed limit of
32. If more than 32 Accept headers were present the code would write outside
of its memory and cause a crash.

  *   AST-2018-005: Crash when large numbers of TCP connections are closed suddenly
A crash occurs when a number of authenticated INVITE messages are sent over
TCP or TLS and then the connection is suddenly closed. This issue leads to a
segmentation fault.

  *   AST-2018-006: WebSocket fram e s with 0 sized payload causes DoS
When reading a websocket, the length was not being checked. If a payload of
length 0 was read, it would result in a busy loop that waited for the
underlying connection to close.

For a full list of changes in the current releases, please see the ChangeLogs:

ChangeLog-13.19.2<https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.19.2>
ChangeLog-14.7.6<https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-14.7.6>
ChangeLog-15.2.2<https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-15.2.2>
ChangeLog-certified-13.18-cert3<https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-13.18-cert3>

The security advisories are available at:

AST-2018-001.pdf<https://downloads.asterisk.org/pub/security/AST-2018-001.pdf>
AST-2018-002.pdf<https://do%20w%20nloads.asterisk.org/pub/security/AST-2018-002.pdf>
AST-2018-003.pdf<https://downloads.asterisk.org/pub/security/AST-2018-003.pdf>
AST-2018-004.pdf<https://downloads.asterisk.org/pub/security/AST-2018-004.pdf>
AST-2018-005.pdf<https://downloads.asterisk.org/pub/security/AST-2018-005.pdf>
AST-2018-006.pdf<https://downloads.asterisk.org/pub/security/AST-2018-006.pdf>

Thank you for your continued support of Asterisk!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-dev/attachments/20180222/610231e1/attachment-0001.html>